-
Notifications
You must be signed in to change notification settings - Fork 4k
How to define order of spring security filter chain #1024
Comments
Yes it is on the same topic. I can't tell you if my issue is due to these changes ? Do you wan't me to redo the test on spring-boot 1.4.1.RELEASE ? |
@kazuki43zoo according to your link and the setup I want. What @order value should I use for |
Could you try as follow ? @Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http.antMatcher("/oauth/**") // ### Specify path pattern that need OAuth authentication(Bearer auth) and authorization
.authorizeRequests()
.antMatchers(
"/**"
).access("#oauth2.hasScope('write') " +
"and #oauth2.clientHasRole('ROLE_CLIENT') " +
"and hasRole('USER')");
}
...
} |
@kazuki43zoo I would like to know if there is a difference between this
and this
With what I did try with Same thing as before, having |
In my understand ... Default orders are as follow on Spring Boot:
In other words, a security filter chain that configure by a extends class of If you want to apply a resource server filter chain for
or
And specify a matcher pattern on (2) as follow: http.antMatcher("/oauth/**")
.authorizeRequests()
.... As result... You can use a resource server filter chain for request that matches If you need more information, i think you should be provide a reproduce project that can be run on GitHub. Thanks. |
Thanks for the quick reply. It seems from the javadoc that http.antMatcher("/oauth/**") is the same as http.requestMatchers().antMatchers("/oauth/**)
I have tried both of the configuration. They seems to be able to protect the endpoint I have created a demo repository. There's a README with a sum up of the security strategy. Reproduction
Expectedhttp status code Resulthttp status code Useful information:Spring server: Security account (cookie):
OAuth account (jwt):
|
Hi, It is still possible to access without a Bearer. See my reply on PR Every configuration I have tried just can't work together on the same endpoint. Are you absolutely sure that spring-security and spring-security-oauth can work on the same endpoint ? It's also possible that the API must have separate endpoints. |
I am having the same problem. I want ldap authentication for some resources and oauth on others and can only get one or the other to work. Not both. Have you made any progress or do you have a work around? |
It is one or the other. You can't have both. |
I have the same problem |
Could you try following code. It works fine for me. https://spring.io/guides/topicals/spring-security-architecture/ @EnableResourceServer
@Configuration
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
super.configure(resources);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.requestMatchers()
// For org.springframework.security.web.SecurityFilterChain.matches(HttpServletRequest)
.requestMatchers(
new NegatedRequestMatcher(
new OrRequestMatcher(
new AntPathRequestMatcher("/login"),
new AntPathRequestMatcher("/logout"),
new AntPathRequestMatcher("/oauth/authorize"),
new AntPathRequestMatcher("/oauth/confirm_access")
)
)
)
.and()
.authorizeRequests().anyRequest().authenticated();
}
} @Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.requestMatchers()
// For org.springframework.security.web.SecurityFilterChain.matches(HttpServletRequest)
.requestMatchers(
new OrRequestMatcher(
new AntPathRequestMatcher("/login"),
new AntPathRequestMatcher("/logout"),
new AntPathRequestMatcher("/oauth/authorize"),
new AntPathRequestMatcher("/oauth/confirm_access")
)
)
.and()
.authorizeRequests().anyRequest().authenticated()
.and()
.formLogin().permitAll()
.and()
.logout().permitAll();
}
}
|
@namioka Shouldn't ResourceServerConfiguration only match negatively on /login and /logout? And WebSecurityConfiguration negatively on /oauth/**? |
@lilalinux '/oauth/authorize' and '/oauth/confirm_access' require the user authentication (Not resource server authentication by access tokens). |
@kopax Did you resolve this issue? I am having same trouble when selecting HttpBasic and OAuth on the basis of Endpoint. |
Me too. With Spring Boot 1.5.8.RELEASE, Spring Security 4.2.3.RELEASE. OAuth filter chain was ignored. |
@kevinojt I have figured out a solution for this. Look at my answer |
Thanks @kevinojt ! It worked perfect for me. |
@cpandya231 yes, it works. Here is my solution same as yours.
|
@kevinojt Please respond on stackoverflow, need to improve reputation points. |
How to define order of spring security filter chain
I am using the following dependency :
I have configured two springSecurityFilterChain using:
My endpoint should be secured like this :
(1) look like this:
(2) look like this:
Problem
If I set
@Order
on:@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
Expected: as a user with a session and without a jwt, I expect to see the the response
401
from (2)Result: as a user with a session and without a jwt, I have the response
401
from (1).If I set
@Order
on:@Order(2)
@Order(3)
Expected: Order the web securityFilterChain before OAuth securityFilterhChain
Result: OAuth securityFilterChain configuration seems to be ignored by spring.
Is there a way to get my configuration to have OAuth security after Basic security ?
The text was updated successfully, but these errors were encountered: